论文标题
超越梯度：在模型反转攻击中利用对手先验
Beyond Gradients: Exploiting Adversarial Priors in Model Inversion Attacks
论文作者
论文摘要
像联合学习这样的协作机器学习设置可能容易受到对抗性干扰和攻击的影响。一类此类攻击称为模型反转攻击，其特征是对手反向工程模型以提取表示形式，从而披露了训练数据。此攻击的事先实现通常仅依赖于捕获的数据（即共享梯度），并且不利用对手本身作为培训财团的一部分的数据。在这项工作中，我们提出了一个新型的模型反转框架，该框架基于基于梯度的模型反转攻击的基础，但还依赖于将重建图像的功能和样式与受对手控制的数据匹配。我们的技术在定性和定量上都优于现有的基于梯度的方法，同时仍保持相同的诚实但充满感染的威胁模型，使对手能够获得增强的重建，同时又保持隐蔽。
Collaborative machine learning settings like federated learning can be susceptible to adversarial interference and attacks. One class of such attacks is termed model inversion attacks, characterised by the adversary reverse-engineering the model to extract representations and thus disclose the training data. Prior implementations of this attack typically only rely on the captured data (i.e. the shared gradients) and do not exploit the data the adversary themselves control as part of the training consortium. In this work, we propose a novel model inversion framework that builds on the foundations of gradient-based model inversion attacks, but additionally relies on matching the features and the style of the reconstructed image to data that is controlled by an adversary. Our technique outperforms existing gradient-based approaches both qualitatively and quantitatively, while still maintaining the same honest-but-curious threat model, allowing the adversary to obtain enhanced reconstructions while remaining concealed.
